Booking

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent booking assistant, but it asks for real booking execution and persistent travel memory without enough confirmation, privacy, or retention safeguards.

Review this skill before installing. It is not deceptive or destructive, but users should require a final booking confirmation screen and should avoid storing payment details, identity documents, precise future itinerary details, or credentials in its local memory files. Stored travel data should be opt-in, owner-only, reviewable, and deletable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:31
• Finding: Booking Transactions Can Be Executed Without Final Confirmation## Vulnerability Details **File Location**: `SKILL.md:31` **Vulnerability Type**: Unsafe autonomous financial transaction **Risk Level**: Medium **Vulnerable Snippet**: ```markdown 7. **Execute when asked** — "book this" means book, not "here's how to book" ``` ### Technical Analysis The instruction treats the contextual phrase `"book this"` as sufficient authorization to execute a financial transaction. It does not require the Agent to display and reconfirm critical transaction details immediately before submission, including: - Property and booking platform - Check-in and check-out dates - Guest count and room configuration - Final price and currency - Cancellation and refund terms - Payment method - Identity and contact information being transmitted Although the Skill separately requires checking the cancellation policy, it does not require explicit user approval of that policy or the final checkout details. An earlier selection may also become stale if availability, fees, taxes, or cancellation terms change during the checkout process. ### Attack Path 1. The Agent presents several accommodation options. 2. The user replies with an ambiguous contextual phrase such as `"book this"`. 3. The Agent interprets that phrase as immediate authorization under the Skill instruction. 4. Availability, pricing, dates, or cancellation terms change, or the Agent resolves the reference to the wrong option. 5. Without displaying a final transaction summary and requesting confirmation, the Agent submits the reservation. 6. The user incurs an unintended charge or receives an incorrect or non-refundable booking. ### Impact Assessment Exploitation does not grant system privileges, but it can cause the Agent to exercise the user's delegated booking and payment capabilities beyond adequately informed consent. The affected scope includes financial charges, reservation commitments, disclosure of personal and payment informa ...[truncated 186 chars]
• Remediation: ## Remediation Suggestions Replace the immediate-execution rule with a mandatory two-stage confirmation process: 1. Treat `"book this"` as authorization to prepare checkout, not to submit it. 2. Retrieve the latest checkout details from the verified platform. 3. Display the exact property, platform domain, dates, guests, room type, complete fee breakdown, final price, currency, cancellation deadline, refundability, and payment method. 4. Clearly identify any difference from the previously quoted price or terms. 5. Request explicit final confirmation, such as: `"Confirm booking for EUR 435, non-refundable, using the saved card ending in 1234."` 6. Submit the transaction only after receiving that confirmation. 7. Require renewed confirmation if any material checkout detail changes. 8. Avoid transmitting payment or identity data to unverified domains and never expose complete credentials in the conversation or persistent memory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17
• Finding: Sensitive Travel Records Are Persisted Without Storage Safeguards## Vulnerability Details **File Location**: `SKILL.md:17-23` **Vulnerability Type**: Plaintext persistence of sensitive travel data **Risk Level**: Medium **Vulnerable Snippet**: ```markdown Store preferences in `~/booking/memory.md`. Load on activation. ``` ~/booking/ ├── memory.md # Traveler type, budget, preferences ├── history.md # Past bookings, liked properties └── alerts.md # Active price tracking ``` ``` ### Technical Analysis The Skill directs the Agent to persist traveler preferences, booking history, and active price alerts in ordinary Markdown files and to load the stored data automatically on activation. It does not define: - User consent requirements - Data-minimization rules - Prohibited sensitive fields - Owner-only file and directory permissions - Encryption requirements - Retention or deletion periods - Session or profile isolation - Rules governing when historical data may be loaded Booking history and active alerts can reveal past locations, future travel plans, periods when a residence may be unoccupied, budget information, and personal preferences. Plaintext files may be exposed to other local users or processes if created under permissive default permissions. Automatic loading can also disclose stale records in an unrelated or shared session. ### Attack Path 1. The Agent collects travel preferences, past booking information, and future travel alerts. 2. It writes those records to Markdown files under `~/booking/`. 3. The files or directory receive permissive default permissions, enter an unencrypted backup, or remain after the information is no longer needed. 4. Another local account, process, tool, backup operator, or later session obtains access to the files. 5. The exposed records reveal travel patterns, planned absences, budget information, or accommodation preferences. ### Impact Assessment This issue does not itself provide privilege escalatio ...[truncated 484 chars]
• Remediation: ## Remediation Suggestions Apply explicit storage and privacy controls: 1. Obtain informed user consent before persisting any travel information. 2. Default to session-only storage unless persistence is specifically requested. 3. Store only necessary preferences; do not store payment credentials, authentication tokens, identity documents, complete addresses, or security codes. 4. Create `~/booking/` with owner-only permissions such as `0700` and stored files with permissions such as `0600`. 5. Use an operating-system credential store or appropriately encrypted storage for information requiring stronger protection. 6. Separate data by user or profile and prevent records from being loaded into unrelated sessions. 7. Load persistent records only when relevant and after authorization, rather than automatically on every activation. 8. Define retention periods and provide commands to inspect, correct, export, and securely delete stored data. 9. Redact booking references and precise future itinerary details where they are not operationally necessary. 10. Document backup implications and ensure deletion policies also cover synchronized or backed-up copies where feasible.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs persistent storage of traveler preferences, booking history, and price alerts without any privacy notice, retention policy, or minimization guidance. Because booking data can reveal habits, budgets, destinations, and potentially sensitive personal context, silent retention increases privacy and data exposure risk.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill says to load preferences on activation, but does not define clear activation boundaries or consent checks before reading from persistent local storage. In a booking skill, ambiguous auto-loading can cause unnecessary exposure of sensitive travel preferences or history across unrelated sessions or users on the same environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|------|---------------------|
| Casual | Ignoring stated budget, recommending based on popularity not fit |
| Business | Missing corporate rates, not understanding loyalty program math |
| Family | Treating "2 bedrooms" as sufficient without checking bed config, missing safety issues |
| Backpacker | Recommending mid-range, not calculating fees, missing hostel direct pricing |
| Nomad | Multiplying nightly×30 instead of real monthly rate, trusting "wifi included" |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.